Security Test: Large JSON input¶

Description¶

Default Severity: medium

When a system accepts an extremely large JSON input as an argument, it can be tricked into spending too much time or memory processing the data. This is dangerous because attackers could send such huge inputs deliberately, causing the system to slow down, crash, or become unresponsive. Developers often overlook input limits or validations, assuming that inputs will always be well-formed and within reasonable size, making the application vulnerable to denial-of-service attacks. If left unaddressed, the system might suffer from degraded performance or even complete outages, which could lead to service disruptions and further security complications.

Reference:

• https://gusralph.info/file-upload-checklist/

Configuration¶

Identifier: resource_limitation/large_json_input

Examples¶

All configuration available:

checks:
  resource_limitation/large_json_input:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶